Connect the Playbook
Kadu reads the Playbook in two ways: through Kadu's GitHub App (recommended) or through an SSH deploy key. In both cases the access is read-only.
Kadu's GitHub App (recommended)​
This is the path of the first console sign-in: the Connect your Playbook card leads to the installation. See Getting started.
| With the GitHub App | |
|---|---|
| Permission | Contents: Read-only, only on the repositories chosen at installation |
| Reading | an installation token generated on each read, valid for 1 hour, restricted to the organization's repository |
| Updating | each push to the default branch notifies Kadu, which syncs right away |
| Disconnection | uninstalling the App, suspending the installation or removing the repository from it disconnects the organization |
On returning from GitHub, the console confirms that the installation belongs
to whoever made it before linking the repository. If the installation covers
several repositories, the console asks you to choose which one is the Playbook, marking
those with the Playbook catalog, .claude-plugin/marketplace.json.
Deploy key (without the App)​
For a repository maintained by Kobana, or when the App cannot be installed:
- The Kobana team registers the repository's SSH address on the organization
(
git@github.com:<owner>/<repository>.git). - Kadu generates a key pair and shows the public key.
- On GitHub, under Settings → Deploy keys → Add deploy key, paste the public key without checking "Allow write access".
- For updates on every push, configure under Settings → Webhooks → Add
webhook the URL and secret the Kobana team gives you, with content type
application/jsonand the "Just the push event" event.
The private key is stored encrypted and never leaves Kadu. Without the webhook, the sync still happens through the hourly check.
What Kadu stores​
- The repository address and, without the App, the encrypted deploy key.
- The catalog: the frontmatter of skills with a
task:block, read on each sync. - The latest commits read, shown in Settings → Deployment.
Kadu keeps no copy of the skills' code: each execution clones the default branch at the moment it starts and deletes the clone at the end.
One Playbook per organization​
An organization has a single Playbook, and all its workspaces are in it. For a new business domain, create a new plugin in the same repository (New workspace), not a new repository.